General

  • Target

    84430187a0f4c30d75529551c26d3e0a_JaffaCakes118

  • Size

    51KB

  • Sample

    240530-qfxwjaah48

  • MD5

    84430187a0f4c30d75529551c26d3e0a

  • SHA1

    ee84b7dd72e4b8a72f6c0134e1bdbede10929c35

  • SHA256

    f764c732eb8f6ea2df333c6e85f7065b5c3bd7a198a7f2878985377525e5f993

  • SHA512

    5f9f5354a993f497b100807d9c2454e9210ba9d032e2f960fd4759db65bd73e47a5a7720cb6b5ff471e61875c10c423c7f9352b0191e136435d0b5a045baa47d

  • SSDEEP

    768:SnrFR/LMpDcbhmtskFxDtv514fIL/WJBiFJ5620Y4xRgbkpg86:e/oVmkFxB51OILWJBe56Pc

Malware Config

Targets

    • Target

      84430187a0f4c30d75529551c26d3e0a_JaffaCakes118

    • Size

      51KB

    • MD5

      84430187a0f4c30d75529551c26d3e0a

    • SHA1

      ee84b7dd72e4b8a72f6c0134e1bdbede10929c35

    • SHA256

      f764c732eb8f6ea2df333c6e85f7065b5c3bd7a198a7f2878985377525e5f993

    • SHA512

      5f9f5354a993f497b100807d9c2454e9210ba9d032e2f960fd4759db65bd73e47a5a7720cb6b5ff471e61875c10c423c7f9352b0191e136435d0b5a045baa47d

    • SSDEEP

      768:SnrFR/LMpDcbhmtskFxDtv514fIL/WJBiFJ5620Y4xRgbkpg86:e/oVmkFxB51OILWJBe56Pc

    • njRAT/Bladabindi

      Widely used RAT written in .NET.

    • Modifies Windows Firewall

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Drops startup file

    • Executes dropped EXE

    • Loads dropped DLL

    • Adds Run key to start application

MITRE ATT&CK Enterprise v15

Tasks